AvosLocker Campaign Used Log4Shell to Enter Network and Deploy Ransomware
Summary
Talos detailed an AvosLocker campaign that exploited vulnerable VMware Horizon gateways affected by Log4Shell, then used tools including Sliver, Cobalt Strike and Mimikatz to move through a victim network and encrypt files.
Key points
- The attackers entered through internet-exposed VMware Horizon Unified Access Gateways vulnerable to Log4Shell; unconfigured firewalls allowed access to internal servers.
- The campaign used encoded PowerShell, Sliver, Cobalt Strike, Mimikatz, SoftPerfect Network Scanner and AnyDesk.
- Attackers used WMIC for lateral movement and PDQ Deploy to distribute the ransomware across the network.
- Talos found signs that other threat actors may also have accessed the victim network, including unrelated cryptocurrency-miner artifacts and DarkComet samples.
- The victim's security products generated alerts that went unreviewed; Talos emphasized patching and configuring appliances and monitoring security alerts.
- AvosLocker encrypted victim files and displayed a ransom note; Talos published associated hashes and IP indicators.
Article Details
- Attack Vectors
- The incident began through an internet-exposed ESXi server accessed via VMware Horizon Unified Access Gateways vulnerable to Log4Shell.
- The attackers used encoded PowerShell commands with DownloadString to retrieve and execute payloads.
- The attackers used WMIC to modify administrative settings on local and remote hosts, and PDQ Deploy to distribute ransomware and other tools across the network.
- AvosLocker was delivered using the victim company's name as the filename; the attackers also used AnyDesk to transfer a network scanner.
- Defensive Notes
- Properly configure security appliances and inner-transit firewalls, and apply updates and patches.
- Monitor and review security alerts; the article reports that events detected during this incident were not reviewed.
- Use layered defenses, including endpoint protection and system-behavior analysis, to detect and contain post-exploitation activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 176[.]113[.]115[.]107 | IP listed in the article's threat indicators. |
| IPV4 | 45[.]136[.]230[.]191 | Payload host used by the encoded PowerShell download command and listed as an indicator. |
| SHA256 | 29a3ae1d32e249d01b39520cd1db27aa980e646d83694ff078424bed60df9304 | Hash listed under the article's MimikatZ indicators. |
| SHA256 | 48514e6bb92dd9e24a16a4ab1c7c3bd89dad76bef53cec2a671821024fadcb2b | Hash listed among Cobalt Strike artifacts. |
| SHA256 | 61239d726c92c82f553200ecbec3ac18d251902fb9ca4d4f52263c82374a5b75 | Hash listed among Cobalt Strike artifacts. |
| SHA256 | 63bdd396ff6397b3a17913badb7905c88e217d0a8cf864ab5e71cc174a4f97a1 | Hash listed under the article's MimikatZ indicators. |
| SHA256 | 63ebb998ebbbfe3863214a85c388fc23b58af4492b2e96eb53c436360344d79d | Hash listed under the article's MimikatZ indicators. |
| SHA256 | 7f0deab21a3773295319e7a0afca1bea792943de0041e22523eb0d61a1c155e2 | Hash listed as a Sliver indicator. |
| SHA256 | 912018ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0658d9 | Hash listed under the article's MimikatZ indicators. |
| SHA256 | 978dffa295ac822064ff6f7a6b6bc498e854f833d36633214d35ccce70db4819 | Hash listed for the archive containing Cobalt Strike beacons and a port scanner. |
| SHA256 | cac73029ad6a543b423822923967f4c240d02516fab34185c59067896ac6eb99 | Hash listed under the article's MimikatZ indicators. |
| SHA256 | cee38fd125aa3707dc77351dde129dba5e5aa978b9429ef3e09a95ebf127b46b | Hash listed as an AvosLocker indicator. |
| SHA256 | e4af7f048e93b159e20cc3efbacdb68e3c1fb213324daf325268ccb71f6c3189 | Hash listed among Cobalt Strike artifacts. |
| SHA256 | e68f9c3314beee640cc32f08a8532aa8dcda613543c54a83680c21d7cd49ca0f | Hash listed among Cobalt Strike artifacts. |
| SHA256 | f2faa8a91840de16efb8194182bcfa9919b74a2c2de40d6ed4791a3308897a01 | Hash listed under the article's MimikatZ indicators. |
| SHA256 | ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f | Hash listed as an AvosLocker indicator. |
MITRE ATT&CK
T1047 · Windows Management InstrumentationThe attackers used WMIC to modify administrative settings on local and remote hosts.T1059.001 · PowerShellEncoded PowerShell commands used DownloadString to retrieve scripts and payloads.T1486 · Data Encrypted for ImpactAvosLocker encrypted the victim's files.T1570 · Lateral Tool TransferThe attackers transferred SoftPerfect Network Scanner to another server using AnyDesk.
CVE
People
Threat Actors
Malware
AvosLockerIn a recent customer engagement, we observed a month-long AvosLocker campaign.DarkCometHowever, there is significant evidence that multiple threat actors had compromised this network, as DarkComet samples unrelated to this campaign were also discovered.Mimikatzcampaign. In the following days, several PowerShell scripts downloaded additional files, including Mimikatz and a .zip archive called "IIS Temporary Compressed Files.zip" containing Cobalt Strike beacons and aSliverThe attackers utilized several different tools, including Cobalt Strike, Sliver and multiple commercial network scanners.
Vendors
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.AnyDeskOn March 8, another instance of the SoftPerfect Network Scanner was transferred via AnyDesk to another server in the network. Later that day, the AvosLocker payload was finally delivered, using the victim's company nameCisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointThe victim in this case used Cisco Secure Endpoint (formerly known as Advanced Malware Protection) as its EPP/EDR solution on most endpoints, from workstations to servers, which allowed Talos to collect importantCisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.ESXiinfection vector to deliver ransomware. In this particular incident, however, the initial vector was an ESXi server exposed on the internet over VMWare Horizon Unified Access Gateways (UAG), which was vulnerable toMeraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.PDQ DeployTo proliferate the ransomware and other tools across the target network, the attackers used PDQ Deploy, a legitimate software deployment tool. Once the ransomware was delivered, the victims files were then encrypted andSnort Subscriber Rule SetOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.SoftPerfect Network ScannerThis port scanner is a commercially available product which Avos is known for deploying called SoftPerfect Network Scanner. Later that same day, the attackers utilized WMIC to modify administrative settings on both aThreat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.VMware Horizon Unified Access GatewaysThe initial ingress point in this incident was a pair of VMWare Horizon Unified Access Gateways that were vulnerable to Log4Shell. While Cisco products were deployed on the network, the appliances were never configured,
Tools
Cobalt StrikeThe attackers utilized several different tools, including Cobalt Strike, Sliver and multiple commercial network scanners.Mimikatzcampaign. In the following days, several PowerShell scripts downloaded additional files, including Mimikatz and a .zip archive called "IIS Temporary Compressed Files.zip" containing Cobalt Strike beacons and aSliverThe attackers utilized several different tools, including Cobalt Strike, Sliver and multiple commercial network scanners.SoftPerfect Network ScannerThis port scanner is a commercially available product which Avos is known for deploying called SoftPerfect Network Scanner. Later that same day, the attackers utilized WMIC to modify administrative settings on both a